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J^ . Abstract 

^5 ■ In 1992, Bartholdi, Tovey, and Trick opened the study of control attacks on 

elections — attempts to improve the election outcome by such actions as adding/deleting 
candidates or voters. That work has led to many results on how algorithms can be used 

t_^ I to find attacks on elections and how complexity-theoretic hardness results can be used as 

shields against attacks. However, all the work in this line has assumed that the attacker 
employs just a single type of attack. In this paper, we model and study the case in 
which the attacker launches a multipronged (i.e., multimode) attack. We do so to more 
realistically capture the richness of real-life settings. For example, an attacker might 

^^ ■ simultaneously try to suppress some voters, attract new voters into the election, and 

JH I introduce a spoiler candidate. Our model provides a unified framework for such varied 

attacks, and by constructing polynomial-time multiprong attack algorithms we prove 
that for various election systems even such concerted, flexible attacks can be perfectly 
planned in deterministic polynomial time. 

1 Introduction 

Elections are a central model for collective decision-making: Actors' (voters') preferences 
among alternatives (candidates) are input to the election rule and a winner (or winners in 
the case of ties) is declared by the rule. Bartholdi, Orlin, Tovey, and Trick initiated a line of 
research whose goal is to protect elections from various attacking actions intended to skew 
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the election's results. Bartholdi, Orlin, Tovey, and Trick's strategy for achieving this goal 
was to show that for various election systems and attacking actions, even seeing whether 
for a given set of votes such an attack is possible is NP-complete. Their papers jBTT89a] 
IB091l[BTT92j consider actions such as voter manipulation (i.e., situations where a voter 
misrepresents his or her vote to obtain some goal) and various types of election control 
(i.e., situations where the attacker is capable of modifying the structure of an election, 
e.g., by adding or deleting either voters or candidates). Since then, many researchers have 
extended Bartholdi, Orlin, Tovey, and Trick's work by providing new models, new results, 
and new perspectives. But to the best of our knowledge, until now no one has considered 
the situation in which an attacker combines multiple standard attack types into a single 
attack — let us call that a multipronged (or multimode) attack. 

Studying multipronged control is a step in the direction of more realistically modeling 
real-life scenarios. Certainly, in real-life settings an attacker would not voluntarily limit 
himself or herself to a single type of attack but rather would use all available means of 
reaching his or her goal. For example, an attacker interested in some candidate p winning 
might, at the same time, intimidate p's most dangerous competitors so that they would 
withdraw from the election, and encourage voters who support p to show up to vote. In 
this paper we study the complexity of such multipronged control attackso 

Given a type of multiprong control, we seek to analyze its complexity. In particular, 
we try to show either that one can compute in polynomial time an optimal attack of that 
control type, or that even recognizing the existence of an attack is NP-hard. It is particularly 
interesting to ask about the complexity of a multipronged attack whose components each 
have efficient algorithms. We are interested in whether such a combined attack (a) becomes 
computationally hard, or (b) still has a polynomial-time algorithm. Regarding the (a) case, 
we give an example of a natural election system that displays this behavior. Our paper's core 
work studies the (b) case and shows that even attacks having multiple prongs can in many 
cases be planned with perfect efficiency. Such results yield as immediate consequences all 
the individual efficient attack algorithms for each prong, and as such allow a more compact 
presentation of results and more compact proofs. But they go beyond that: They show that 
the interactions between the prongs can be managed without such cost as to move beyond 
polynomial time. 

Related work. Since the seminal paper of Bartholdi, Tovey, and Trick [BTT92J . much 
research has been dedicated to studying the complexity of control in elections. Bartholdi, 
Tovey, and Trick |BTT92| considered constructive control only, i.e., scenarios where the 
goal of the attacker is to ensure some candidate's victory. Hemaspaandra, Hemaspaandra, 
and Rothe |HHR07j extended their work to the destructive case, i.e., scenarios in which the 
goal is to prevent someone from winning. 

A central but elusive goal of control research is finding a natural election system (with 
a polynomial-time winner algorithm) that is resistant to all the standard types of control, 
i.e., for which all the types of control are NP-hard. Hemaspaandra, Hemaspaandra, and 
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Rothe |HHR09J showed that there exist highly resistant artificial election systems. Fal- 
iszewski et al. [FHHROQa] then showed that the natural system known as Copeland voting 
is not too far from the goal mentioned above. And Erdelyi, Rothe, and Nowak |ENR09] 
then showed a system with even more resistances than Copeland, but in a slightly non- 
standard voter model (see [BEH"*" for discussion and [EPRlObllEPRlOaUMenlO] for some 



related follow-up work). 

Recently, researchers also started focusing on the parameterized complexity of control 
in elections. Faliszewski et al. |FHHR09a] provided several fixed-parameter tractability 
results. Betzler and Uhlmann [BU09| and Liu et al. |LFZL09| showed so-called W[l]- and 
W[2]-hardness results for control under various voting rules. In response to the conference 
version of the present paper |FHH09b] , Liu and Zhu conducted a parameterized-complexity 
study of control in maximin elections [LZlOj . 

Going in a somewhat different direction, Meir et al. [MPRZ08] bridged the notions 
of constructive and destructive control by considering utility functions, and in this model 
obtained control results for multiwinner elections. In multiwinner elections the goal is to 
elect a whole group of people (consider, e.g., parliamentary elections) rather than just a 
single person. Elkind, Faliszewski, and Slinko |EFS10] and Chevaleyre et al. [MLCMIO] 
considered two types of problems related to control by adding candidates for the case where 
it is not known how the voters would rank the added candidates. 

Faliszewski et al. |FHHR09c] and Brandt et al. |BBHH10] have studied control (and 
manipulation and bribery) in so-called single-peaked domains, a model of overall electorate 
behavior from political science. 

There is a growing body of work on manipulation that regards frequency of 
(non)hardness of election problems (see, e.g., [CS"06llFKN08llDP08llXC08bllXC08a[IWal09j ) . 
This work studies whether a given NP-hard election problem (to date only manipula- 
tion/winner problems have been studied, not control problems) can be often solved in 
practice (assuming some distribution of votes). Such results are of course very relevant 
when one's goal is to protect elections from manipulative actions. However, in this paper 
we typically take the role of an attacker and design control algorithms that are fast on all 
instances. 

Faliszewski et al. |FHHR09byFHH] provide an overview of some complexity-of-election 
issues. 

Organization. In Section [2] we present the standard model of elections and describe 
relevant voting systems. In Section[3]we introduce multiprong control, provide initial results, 
and show how existing immunity, vulnerability, and resistance results interact with this 
model. In Section 2] we provide a complexity analysis of voter and candidate control in 
maximin elections, showing how multiprong control is useful in doing so. We also show that 
maximin has an interesting relation to Dodgson elections: No candidate whose Dodgson 
score is more than m^ times that of the Dodgson winner (s) can be a maximin winner. 
In Section [5] we consider fixed-parameter complexity of multiprong control, using as our 
parameter the number of candidates. Section [6] provides conclusions and open problems. 



2 Preliminaries 

Elections. An election is a pair (C, V), where C = {ci, . . . ,Cm} is the set of candidates 
and V = (vi, . . . ,Vn) is a collection of voters. Each voter Vi is represented by his or her 
preference listcl For example, if we have three candidates, ci, C2, and C3, a voter who likes 
ci most, then C2, and then C3 would have preference list ci > C2 > C30 Given an election 
E = (C, V), by NE{ci,Cj), where Cj, Cj G C and i ^ j, we denote the number of voters in V 
who prefer q to Cj. We adopt the following convention for specifying preference lists. 

Convention A. Listing some set D of candidates as an item in a preference list means 
listing all the members of this set in some fixed, arbitrary order, and listing D means listing 
all the members of D, but in the reverse order. 

An election system is a mapping that given an election (C, V) outputs a set W, satisfying 
W (^ C, called the winners of the election. 

We focus on the following five voting systems: plurality, Copeland, maximin, approval, 
and Condorcet. (However, in Sections 14.41 and [5] we take a detour through some other 
systems.) Each of plurality, Copeland, maximin, and approval assigns points to candidates 
and elects those that receive the most points. Let E = (C, V) be an election, where 
C = {ci, . . . , Cm} and V = {vi, . . . ,Vn)- In plurality, each candidate receives a single point 
for each voter who ranks him or her first. In maximin, the score of a candidate Cj in E is 
defined as minc,g(7_r^.-i NE{ci, Cj). For each rational a, < a < 1, in Copeland"^ candidate 
Cj receives 1 point for each candidate Cj, j ^ i, such that NE{ci,Cj) > NE{cj,Ci) and a 
points for each candidate Cj, j / i, such that NE{ci,Cj) = Ne{cj, Ci). That is, the parameter 
a describes the value of ties in head-to-head majority contests. In approval, instead of 
preference lists each voter's ballot is a 0-1 vector, where each entry denotes whether the voter 
approves of the corresponding candidate (gives the corresponding candidate a point). For 
example, vector (1, 0, 0, 1) means that the voter approves of the first and fourth candidates, 
but not the second and third. We use scores; (cj) to denote the score of candidate Cj in 
election E (the particular election system used will always be clear from context). 

A candidate c is a Condorcet winner of an election E = [C, V) if for each other candidate 
c' € C it holds that Ne{c,c') > Ne{c',c). Clearly, each election has at most one Condorcet 
winner. (Not every election has a Condorcet winner. However, as our notion of an election 
allows outcomes in which no one wins, electing the Condorcet winner when there is one and 
otherwise having no winner is a quite legal election system.) 

Computational complexity. We use standard notions of complexity theory, as presented, 
e.g., in the textbook of Papadimitriou |Pap94| . We assume that the reader is familiar with 
the complexity classes P and NP, polynomial-time many-one reductions, and the notions 
of NP-hardness and NP-completeness. N will denote {0, 1, 2, . . .}. 



^We also assume that each voter has a unique name. However, all the election systems we consider 
here — except for the election system of Theorem 13.81 — are anonymous and thus disregard voter names and 
the order of the votes. 

^Preference lists are also called preference orders, and in this paper we will use these two terms inter- 
changeably. 



Most of the NP-hardness proofs in this paper fohow by a reduction from the weh-known 
NP-complete problem exact cover by 3-sets, known for short as X3C (see, e.g., |GJ79| ). 
In X3C we are given a pair (B,S), where B = {bi, . . . , 63^} is a set of 3k elements and 
S = {Si, . . . , 5„} is a set of 3-subsets of B, and we ask whether there is a subset S' of 
exactly k elements of S such that their union is exactly B. We call such a set S' an exact 
cover of B. 

In Section \5\ we consider the fixed-parameter complexity of multiprong control. The 
idea of fixed-parameter complexity is to measure the complexity of a given decision problem 
with respect to both the instance size (as in the standard complexity theory) and some 
parameter of the input (in our case, the number of candidates involved). For a problem 
to be said to be fixed-parameter tractable, i.e., to belong to the complexity class FPT, we 
as is standard require that the problem can be solved by an algorithm running in time 
f{j)rP^^\ where n is the size of the encoding of the given instance, j is the value of the 
parameter for this instance, and / is some function. Note that / does not have to be 
polynomially bounded or even computable. However, in all FPT claims in this paper, / is 
a computable function. That is, our algorithms actually achieve so-called strongly uniform 
fixed-parameter tractability. We point readers interested in parameterized complexity to, 
for example, Niedermeier's book jNieOGj . 

3 Control and Multiprong Control 

In this section we introduce multiprong control, that is, control types that combine several 
standard types of control. We first provide the definition, then proceed to analyzing general 
properties of multiprong control, then consider multiprong control for election systems for 
which the complexity of single-prong control has already been established, and finally give 
an example of an election system for which multiprong control becomes harder than any of 
its constituent prongs (assuming P 7^ NP). 

3.1 The Definition 

We consider combinations of control by adding/deleting candidates/voterqj and by bribing 
voters. Traditionally, bribery has not been considered a type of control but it fits the model 
very naturally and strengthens our results. 

In discussing control problems, we must be very clear about whether the goal of the 
attacker is to make his or her preferred candidate the only winner, or is to make his or 
her preferred candidate a winner. To be clear on this, we as is standard will use the 
term "unique-winner model" for the model in which the goal is to make one's preferred 
candidate the one and only winner, and we will use the term "nonunique-winner model" 
for the approach in which the goal is to make one's preferred candidate be a winner. (Note 
that if exactly one person wins, he or she most certainly is considered to have satisfied the 



^Other control types, defined by Bartholdi, Tovey, and Trick [BTT92| and refined by Hemaspaandra, 
Hemaspaandra, and Rothe [HHR07| . regard various types of partitioning candidates and voters. 



control action in the nonunique-winner model. The "nonunique" in the model name merely 
means we are not requiring that winners be unique.) 

The destructive cases of each of these are, in the nonunique-winner model, blocking 
one's despised candidate from being a unique winnerjfl and in the unique-winner model, 
blocking one's despised candidate from being a winner. We take the unique-winner model 
as the default in this paper, as is the most common model in studies of control. 

Definition 3.1. Let £ be an election system. In the unique-winner)^ constructive £- 
A C+DC+AV+DV+BV control problem we are given: 

(a) two disjoint sets of candidates, C and A, 

(h) two disjoint collections of voters, V and W , containing voters with preference lists 
over C L) A, 

(c) a preferred candidate p & C, and 

(d) five nonnegative integers, kAc, ^DC; ^AV; ^DV> CLiT'd k^v- 

We ask whether it is possible to find two sets. A' ^ A and C C C, and two subcollections 
of voters, V' '^V and W' (^W, such that: 

(e) it is possible to ensure that p is a unique winner of £ election ((C — C") U A', {V — 
V') U W) via changing preference orders of (i.e., bribing) at most /cbv voters in 

{V - V) U w, 

(f) p i a, and 

(g) \\A'\\ < kAc, \\C'\\ < kY)c, \\W'\\ < /CAV, and \\V'\\ < /cdv- 

In the unique-winner, destructive variant of the problem, we replace item (e) above with: "it 
is possible to ensure thatp is not a unique winner of £ election {{C — C')\JA\ {V — V')UW') 
via changing preference orders of at most A:bv voters in {V — V') U W . " (In addition, in the 
destructive variant we refer to p as "the despised candidate" rather than as "the preferred 
candidate, " and we often denote him or her by d.) 

The phrase AC+DC+AV+DV+BV in the problem name corresponds to four of the 
standard types of control: adding candidates (AC), deleting candidates (DC), adding voters 
(AV), deleting voters (DV), and to (unpriced) bribery (BV); we will refer to these five types 
of control as the basic types of control. We again remind the reader that traditionally 
bribery is not a type of control but we will call it a basic type of control for the sake of 
uniformity and throughout the rest of the paper we will consider it as such. 



^We will often use the phrase "a unique winner," as we just did. The reason we write "a unique winner" 
rather than "the unique winner" is to avoid the impression that the election necessarily has some (unique) 
winner. 

"One can easily adapt the definition to the nonunique-winner model. 



Instead of considering all of AC, DC, AV, DV, and BV, we often are interested in some 
subset of them and so we consider special cases of the AC+DC+AV+DV+BV problem. 
For example, we write DC+AV to refer to a variant of the AC+DC+AV+DV+BV problem 
where only deleting candidates and adding voters is allowed. As part of our model we 
assume that in each such variant, only the parameters relevant to the prongs are part of 
the input. So, for example, DC+AV would have /cdci ^AVi C*, V, W, and p as the (only) 
parts of its input. And the "missing" parts (e.g., for DC+AV, the missing parts are A, fcAC; 
/cdV) and /cbv) are treated in the obvious way in evaluating the formulas in Definition 13. H 
namely, missing sets are treated as and missing constants are treated as 0. If we name 
only a single type of control, we in effect degenerate to one of the standard control problems. 
We for historical reasons consider also a special case of the AC control type, denoted ACu 
(and called control by adding an unlimited number of candidates), where there is no limit 
on the number of candidates to add, i.e., /cac = ll^ll- 

There is at least one more way in which we could define multiprong control. The model 
in the above definition can be called the separate-resource model, as the extent to which 
we can use each basic type of control is bounded separately. In the shared-resource model 
one pool of action allowances must be allocated among the allowed control types (so in 
the definition above we would replace A;ac ) ^DC i ^AV > and A;dv with a single value, k, and 
require that HC^'H + ||^'|| + ||^'|| + \\W\\ + the-numher-of-hrihed-voters < k). Although one 
could make various arguments about which model is more appropriate, their computational 
complexity is related. 

Theorem 3.2. // there is a polynomial-time algorithm for a given variant of multiprong 
control in the separate-resource model then there is one for the shared-resource model as 
well. 

Proof. Let 8 be an election system. We will describe the idea of our proof on the example of 
the constructive £'-AC+AV problem. The idea easily generalizes to any other set of allowed 
control actions (complexity-theory savvy readers will quickly see that we, in essence, give a 
disjunctive truth-table reduction). 

We are given an instance / of the constructive £'-AC+AV problem in the shared-resource 
model, where k is the limit on the sum of the number of candidates and voters that we may 
add. Given a polynomial-time algorithm for the separate-resource variant of the problem, 
we solve / using the following method. (If k > ||^|| + \\W\\ then set k = \\A\\ + ||VF||.) 
We form a sequence Iq, . . . , /fc of instances of the separate-resource variant of the problem, 
where each le, < i < k, is identical to /, except that we are allowed to add at most i 
candidates and at most k — i voters. We accept if at least one of Ii is a "yes" -instance of 
the separate-resource, constructive £^-AC+AV problem. Clearly, this algorithm is correct 
and runs in polynomial time. D 

It would be interesting to consider a variant of the shared-resource model where var- 
ious actions come at different costs (e.g., adding some candidate c' might be much more 
expensive — or difficult — than adding some other candidate c"). This approach would be 



close in spirit to priced bribery of |FHH09a] . Analysis of such priced control is beyond the 
scope of the current paper. 

3.2 Susceptibility, Immunity, Vulnerability, and Resistance 

As is standard in the election-control (and election-bribery) literature, we consider vulner- 
ability, immunity, susceptibility, and resistance to control. Let £ be an election system and 
let C be a type of control. We say that £ is susceptible to constructive (destructive) C 
control if there is a scenario in which effectuating C makes someone become (stop being) a 
unique winner of some £ election E. £ is immune to constructive (destructive) C control 
if £ is not susceptible to constructive (destructive) C control. We say that £ is vulnerable 
to constructive (destructive) C control if £ is susceptible to constructive (destructive) C 
and there is a polynomial-time algorithm that decides the constructive (destructive) £-C 
problem. Actually, this paper's vulnerability algorithms/proofs will each go further and will 
in polynomial time produce, or will make implicitly clear how to produce, the successful 
control action. So we in each case are even achieving the so-called certifiable vulnerabil- 
ity of Hemaspaandra, Hemaspaandra, and Rothe [HHR07J . £ is resistant to constructive 
(destructive) C control if £ is susceptible to (destructive) C control and the constructive 
(destructive) £-C problem is NP-hard. 

The next three theorems describe how multiprong control problems can inherit suscep- 
tibility, immunity, vulnerability, and resistance from the basic control types that they are 
built from. 

Theorem 3.3. Let £ he an election system and let Ci + ■ ■ ■ + Ck he a variant of multiprong 
control (so 1 < A: < 5 and each Ci is a hasic type of control). £ is susceptihle to constructive 
(destructive) Ci + - ■ ■+Ck control if and only if £ is susceptihle to at least one of constructive 
(destructive) Ci, . . . , C^ control. 

Proof. The "if" direction is trivial: The attacker can always choose to use only the type 
of control to which £ is susceptible. As to the "only if" direction, it is not hard to see 
that if there is some input election for which by a Ci + • • • + C^ action we can achieve 
our desired change (of creating or removing unique-winnerhood for p, depending on the 
case), then there is some election (not necessarily our input election) for which one of those 
actions alone achieves our desired change. In essence, we can view a control action A of 
type Ci -|- • • • + Cfc as a sequence of operations, each one of one of the Ci, . . . ,Ck types, 
that — when executed in order — transform our input election into an election where our goal 
is satisfied. Thus there is a single operation within A — and this operation is of one of the 
types Ci , . . . , Cfc — that transforms some election E' where our goal is not satisfied to some 
election E" where the goal is satisfied. D 

In the next theorem we show that if a given election system is vulnerable to some basic 
type of control and is immune to another basic type of control, then it is vulnerable to 
these two types of control combined. The proof of this theorem is easy, but we need to be 
particularly careful as vulnerabilities and immunities can behave quite unexpectedly. For 



example, it seems that we can assume that if an election system is vulnerable to AV and DV 
then it should also be vulnerable to BV, because bribing a particular voter can be viewed 
as first deleting this voter and then adding — in his or her place — a voter with the preference 
order as required by the briber. (This assumes we have such a voter among the voters we can 
add, but when arguing susceptibility/immunity we can make this assumption.) However, 
there is an easy election system that is vulnerable to both AV and DV control, but that 
is immune to BV control. This system simply says that in an election E = {C,V), where 
C = {ci, . . . , Cm} and V = {vi, . . . , Vn), the winner is the candidate Cj such that n = i — 1 
(mod ?7i)|I| 

Theorem 3.4. Let 8 he an election system, and letCi + ---+Ck + Di + • • • + D^ he a variant 
of multiprong control (so 1 < k,i < 5 and each Ci and each Di is a hasic control type) such 
that £ is vulnerahle to constructive (destructive) Ci + ■ ■ ■ + C^ control hut is immune to 
constructive (destructive) Di + - ■ ■+D£ control. £ is vulnerahle to Ci + - ■ ■+Ck+Di + - ■ ■+D£ 
control. 

Proof. We will give a proof for the constructive case only. The proof for the destructive 
case is analogous. Let £ be an election system as in the statement of the theorem and let 
/ be an instance of constructive £-Ci + ■ ■ ■ + C^ + Di + ■ ■ ■ + Di control, which contains 
election E = (C,V), information about the specifics of control actions we can implement, 
and where the goal is to ensure that candidate p is a unique winner. Let us first consider 
the case where BV is not among Ci, . . . ,Ck,Di, . . . Di. 

Let us assume that there is a sequence A of control actions of types Ci, . . .Ck,Di, . . . , Di, 
such that (a) applying ^ to -E is a legal control action within /, and (b) applying A to E 
results in an election Ec+d where p is the unique winner. (We take A to be an empty 
sequence if p is a unique winner oi E.) We split the sequence A into a subsequence Ac 
that contains exactly the actions of types Ci, . . . , C^, and a subsequence Ao that contains 
exactly the actions of types Di, . . . ,Di. Since BV is not among our control actions, it is 
easy to see that it is possible to apply actions Ac to election E to obtain some election Ec- 
(To see why it is important that we do not consider BV, assume that BV is among control 
types Ci, . . . , Cfc and AV is among control types Di, . . . , Di. In this case, Ac might include 
an action that bribes a voter that is added by an action from A^.) 

We claim that p is a unique winner of Ec- For the sake of contradiction, let us assume 
that this is not the case (note that this implies that p is not a unique winner of E) . If we 
apply control actions Ad to Ec, we reach exactly election Ec+d, where p is the unique 
winner. Yet, this is a contradiction, because we assumed that £ is immune to Di + ■ ■ ■ + Di, 
i.e., that there is no scenario where control action of type Di + - ■ ■+i?^ makes some candidate 
a unique winner if he or she was not a unique winner before. 

Thus, it is possible to ensure that p is a unique winner by actions of type Ci + ■ ■ ■ + C^ 
alone. We chose I arbitrarily, and thus any instance of £-Ci + ■ ■ ■ + Ck + Di + ■ ■ ■ + Di 
control can be solved by an algorithm that considers control actions of type Ci + ■ ■ ■ + C^ 



^Of course, this election system is not neutral; permuting the names of the candidates can change the 
outcome of an election. 



only. This proves that £ is vulnerable to Ci + ■■■ + Ck + Di + ■■■+ Di control because, as 
we have assumed, it is vulnerable to Ci + • • • + Cfc control. 

It remains to prove the theorem for the case where BV is among our control actions. In 
the case where BV is among the control actions but AV is not, or if AV and BV are in the 
same group of actions (i.e., either both are among the Cj's or both are among the -Dj's), it 
is easy to see that the above proof still works. Similarly, if BV is among the Dj's and AV 
is among the Cj's, the above proof works as well. The only remaining case is if our allowed 
control types include both BV and AV, where BV is among the Cj's and AV is among the 
A's. 

In this last case, the proof also follows the general structure of the previous construction, 
except that we have to take care of one issue: It is possible that sequence Ac includes bribery 
of voters that are to be added by actions from Ao. (We use the same notation as in the 
main construction.) Let V^v be the collection of voters that Aq requires to bribe, but that 
are added in A^. We form a sequence A'(j that is identical to Ac-, except that it starts by 
adding the voters from V^m, and we let A'j^ be identical to ^d, except that it no longer 
includes adding the voters from Fbv- Using sequences A'(j and A'j^ instead of Ac and A^, it 
is easy to show the following: If it is possible to ensure that p is a unique winner in instance 
/ by a legal action of type Ci + ■ ■ ■ + Ck + Di + ■ ■ ■ + D^, then it is also possible to do so 
by a legal action of type Ci + • • • + C^ + AV ., where each added voter is also bribed. Thus, 
given an instance / of £-Ci + • • • + Cfc + Z?i + • • • + D^ we can solve it using the following 
algorithm. Let W be the collection of voters that can be added within / and let ^av be the 
limit on the number of voters that we can add. 

1. Let t be max(A;AV5 11^^11)- 

2. For each i in {0, 1, . . . ,t} execute the next two substeps. 

(a) Form instance /' that is identical to /, except i (arbitrarily chosen) voters from 
W are added to the election. 

(b) Run the £-Ci + ■ ■ ■ + Ck algorithm on instance /' and accept if it does. 

3. If the algorithm has not accepted yet, reject. 

It is easy to see that this algorithm is correct and, since £ is vulnerable to Ci + • • • + C^, 
works in polynomial time. This completes the proof of the theorem. D 

Theorem 3.5. Let £ he an election system and let Ci + ■ ■ ■ + Ck, 1 < A; < 5, he a variant 
of multiprong control. If for some i, 1 <i <k, £ is resistant to constructive (destructive) 
Ci control, then £ is resistant to constructive (destructive) Ci + • • • + C^ control. 

Proof. Let Cj be the control type to which £ is resistant. Since £ is susceptible to construc- 
tive (destructive) Cj control, it follows by Theorem 13.31 that £ is susceptible to constructive 
(destructive) Ci + • • • + C^ control. And since the £-Ci constructive (destructive) control 
problem is essentially (give or take syntax) an embedded subproblem of the £-Ci + ■ ■ ■ + Ck 
control problem, clearly £ is resistant to Ci + •••-!- C^ control. D 
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By combining the above three theorems, we obtain a simple tool that allows us to classify 
a large number of multiprong control problems based on the properties of their prongs. 

Corollary 3.6. Let £ he an election system and let Ci + ■ ■ ■ + Ck, 1 < ^ < 5, he a variant 
of multiprong control, such that for each Ci, 1 < i < k, £ is resistant, vulnerable, or 
immune to constructive (destructive) Ci control. If there is an i, 1 < i < k, such that 
£ is resistant to constructive (destructive) Ci control then £ is resistant to constructive 
(destructive) Ci + ■ ■ ■ + C^ control. Otherwise, if there is an i, 1 < i < k, such that £ 
is vulnerable to constructive (destructive) Ci control then £ is vulnerable to constructive 
(destructive) Ci + ■ ■ ■ + C^ control. Otherwise, £ is immune to constructive (destructive) 
Ci + ■ ■ ■ + Ck control. 

Theorem 13.51 immediately yields many "free" resistance results based on the previous 
work on control. However, we will focus on the more interesting issue of proving that even 
multiprong control is easy for some election systems whose control has already been studied 
(in Section [3. 3p and for candidate control in maximin (Section [4]). 

In general, we do not consider partition cases of control in this paper. However, we make 
an exception for the next example, which shows how even types of control to which a given 
election system is immune may prove useful in multiprong control. In constructive control 
by partition of candidates (reminder: this is not a basic control type) in the ties-eliminate 
model (PC-TE control type), we are given an election E = (C, V) and a preferred candidate 
p & C, and we ask whether it is possible to find a partition (Ci, C2) of C (i.e., C1UC2 = C 
and Ci n C2 = 0) such that p is a winner of the following two-round election: We first find 
the winner sets, Wi and W2, of elections {Ci,V) and {C2,V). If Wi {W2) contains more 
than one candidate, we set Wi = {W2 = 0), since we are in the "ties eliminate" model. 
The candidates who win election (Wi U W2,V) are the winners of the overall two-stage 
election. 

Now, let us look at constructive approval-AC-|-PC-TE control, where (by definition, let 
us say) we first add new candidates and then perform the partition action. We consider an 
approval election with two candidates, p and c, where p has 50 approvals and c has 100. 
We are also allowed to add candidate c', who has 100 approvals. Clearly, it is impossible 
to make p a unique winner by adding c'. Exercising the partition action alone does not 
ensure p's victory either. However, combining both AC and PC-TE does the job. If we first 
add c' to the election and then partition candidates into {p} and {c,c'} then, due to the 
ties-eliminate rule, p becomes the unique winner. It is rather interesting that even though 
approval is immune to constructive AC control, there are cases where one has to apply AC 
control to open the possibility of effectively using other types of control. 

The above example is perhaps surprising in light of Theorem l3.41 In essence, in the proof 
of that theorem we argue that if an election system is vulnerable to some basic control type 
C but is immune to some other basic control type D, then it is also vulnerable to control 
type C + D. We proved the theorem by showing that we can safely disregard the actions 
of type D (assuming C does not include BV control type). The above example shows that 
this proof approach would not work if we considered PC-TE in addition to the basic control 
types. 
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3.3 Combining Vulnerabilities 

In the previous section we considered the case where separate prongs of a multiprong control 
problem have different computational properties, e.g., some are resistant, some are vulnera- 
ble, and some are immune. In this section we consider the case where an election system is 
vulnerable to each prong separately, and we show how such vulnerabilities combine within 
election systems for which control results were obtained in previous papers (see Table [2]). 
In particular, in the next theorem we show that for all the election systems considered 
in J BTT92J . |HHR07j . and |FHHR09a| . all constructive vulnerabihties to AC, DC, AV, DV, 
and BV combine to vulnerabilities, and all destructive vulnerabilities to AC, DC, AV, DV, 
BV combine to vulnerabilities |f| That is, for each election system studied in these three 
papers, if it is separately vulnerable to some basic control types Ci,...,Cfc, where each 
d G {AC, DC, AV, DV, BV}, it is also vulnerable to Ci + • • • + C7fc- 

Theorem 3.7. (a) Plurality is vulnerable to both constructive AV+DV+BV control and 
destructive AV+DV+BV control. (b) Both Condorcet and approval are vulnerable to 
AC + AV+DV+BV destructive control, (c) For each rational a, < a < 1, Copeland" 
is vulnerable to destructive AC+DC control. 

Proof, (a) Let us consider an instance / of constructive plurality-AV+DV+BV control 
where we want to ensure candidate p's victory: It is enough to add all the voters who vote 
for p (or as many as we are allowed) and then, in a loop, keep deleting voters who vote 
for a candidate other than p with the highest score, until p is the only candidate with the 
highest score or we have exceeded our limit of voters to delete. Finally, in a loop, keep 
bribing voters who vote for a candidate other than p with the highest score to vote for p, 
until p is the only candidate with the highest score or we have exceeded our limit of voters 
to bribe. If p becomes a unique winner via this procedure, then accept. Otherwise reject. 
We omit the easy proof for the destructive case. 

(b) Let I be an instance of destructive Condorcet- AC-|- AV+DV+BV, where our goal is 
to prevent candidate p from being a Condorcet winner (we assume that p is a Condorcet 
winner before any control action is performed). It is enough to ensure that some candidate 
c wins a head-to-head contest with p. Our algorithm works as follows. 

Let C be the set of candidates originally in the election and let A be the set of candidates 
that we can add (we take A = if we are not allowed to add any candidates). For each 
c € (C U A) — {p} we do the following: 

1. Add as many voters who prefer c to p as possible. 

2. Delete as many voters who prefer p to c as possible. 



^Constructive bribery for plurality and constructive bribery for approval have been considered 
in |FHH09a] and constructive and destructive bribery for Copeland has been studied in |FHHR09a] . In 



Theorem 13.71 we — in effect — give polynomial-time algorithms for destructive bribery in plurality, approval, 
and Condorcet. Constructive Condorcet-BV is NP-complete and this is implicitly shown in ,FHHR09al 
Theorem 3.2]. 
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3. Among the remaining voters who prefer p to c, bribe as many as possible to rank c 
first. 

If after these actions c wins his or her head-to- head contest with p then we accept. If no 
c & {C U A) — {p} leads to acceptance, then we reject. It is easy to see that this algorithm 
is correct and runs in polynomial time. (We point out that it is enough to add only a 
single candidate, the candidate c that prevents p from winning, if he or she happens to be 
a member of A). 

For the case of approval, our algorithm works similarly, except the following differences: 
We add voters who approve of c but not of p. We delete voters who approve of p but not of 
c. For each remaining voter Vi, if we still have not exceeded our bribing limit, if Vi approves 
of p but not of c, we bribe Vi to reverse approvals on p and c. (Note that if we do not 
exceed our bribing limit by this procedure, this means that each voter that approves of p 
also approves of c and thus p is not a unique winner.) If these actions lead to p not being 
a unique winner, we accept. If we do not accept for any c G {C L) A) — {p}, we reject. 

(c) The idea is to combine Copeland" destructive-AC and destructive-DC algo- 
rithms [FHHR09a] . We give the full proof for the sake of completeness. 

Let us fix a rational value a, < a < 1. Given an election E and a candidate c in 
this election, we write score^(c) to denote Copeland" score of c. Let / be an instance 
of destructive Copeland°-AC+DC control, with an election E = {C,V), where we can 
add at most A^ac spoiler candidates from the set A, and where we can delete at most /cdc 
candidates. Our goal is to ensure that some despised candidate d G C is not a unique winner. 
Our algorithm is based on the following simple observation of Faliszewski et al. |FHHR09a] . 
For each candidate c G C: 

scovefcy){c) = Yl score^^^^^,|^,)(c). 

c'eC-{c} 

Our goal is to prevent candidate d from being a unique winner. If d is not a unique winner, 
we immediately accept. Otherwise, we seek a candidate c G CU A such that we can ensure 
that c's score is at least as high as that of d. Thus, for each c G C U A we do the following. 

1. If c G A, and A;ac > 0, we add c to the election (and ii c € A but /cac = 0, we proceed 
to the next c). 

2. As long as we can still add more candidates, we keep executing the following operation: 
If there is a candidate c' G A such that value a{c') = score?r ^,-> y\(c)— score ?r^ ^,1 yJd) 
is positive, we add a candidate c" G A, for whom a{c") is highest. 

3. As long as we can still delete candidates, we keep executing the following operation: If 
there is a candidate c' G C such that value r{c') = score^r^^,, yJd) — score?r ^,1 y\{c) 
is positive, we delete a candidate c" G C, for whom r{c") is highest. 

4. If after these steps d is not a unique winner, we accept. 
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If we do not accept for any c € C U A, we reject. 

It is easy to see that we never delete a candidate that we have added. Also, it is easy to 
see that the algorithm works in polynomial time, and that it is correct. Correctness follows 
from the fact that (a) in the main loop of the algorithm, when dealing with candidate 
c (z C L) A, each addition of a candidate and each deletion of a candidate increases the 
difference between the score of c and the score of d as much as is possible, and (b) the order 
of adding/deleting candidates is irrelevant. D 

As witnessed by Theorem 13. 71 and the results of Section HJ for all natural election systems 
that we have considered, all constructive vulnerabilities combine and so do all destructive 
ones. It is natural to wonder whether this is a necessary consequence of our model of 
multiprong control or whether in fact there is an election system for which combining two 
control types to which the system is vulnerable yields a multipronged control problem to 
which the system is resistant. Theorem 13.81 shows that the latter is the case, even for a 
natural (though rather unusual) election system. 

In the thirteenth century, Ramon Llull proposed an election system that could be used 
to choose popes and leaders of monastic orders (see [HP0HIML06J ). In his system, voters 
choose the winner from among themselves (so, the candidates are the same as the voters). 
Apart from that, Llull's voting system is basically Copeland , the version of Copeland that 
most richly rewards ties. Formally, we define the voting system OriginalLlull as follows: 
For an election E = (C,V), if the set of names of V, which we will denote by names(y), 
is not equal to C, then there are no winners. Otherwise, a candidate c E C is a winner 
if and only if it is a Copeland winner. Note that single-prong AC and AV control for 
OriginalLlull don't make all that much sense, and so it should come as no surprise that 
OriginalLlull is vulnerable to both constructive AC control and constructive AV control. In 
addition, we will show (by renaming and padding) that Copeland -AV can be be reduced 
to OriginalLlull -AC+AV. Since Copeland is resistant to constructive control by adding 
voters |FHHR09a] . this then leads to the following theorem. 

Theorem 3.8. OriginalLlull is vulnerable to both constructive AC control and constructive 
AV control but is resistant to constructive AC+AV control. 

Proof. It is immediate that OriginalLlull is susceptible to constructive AC, AV, and (by 
Theorem 13. 3p AC+AV control. It is also easy to see that constructive OriginalLlull- AC 
(AV) control is in P: If possible add candidates (voters) such that the set of voter names 
is equal to the set of candidates, and then check if the preferred candidate is a unique 
Copeland winner. If this is not possible, reject. 

We will now show, via a reduction from constructive Copeland -AV control (which is 
NP-hard |FHHR09a] ) that constructive OriginalLlull- AC+AV control is NP-hard. Let C 
be a set of candidates, V and W be two disjoint collections of voters with preference lists 
over C, p £ C the preferred candidate, and A; € N. The question is whether there exists 
a subcollection W C VF of size at most k such that p is a unique Copeland winner of 
{C,V U W). Without loss of generality, we assume that V is not empty. 
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We will now show how to pad this election. For an OriginalLlull election to be non- 
trivial, we certainly need to have the same number of candidates as voters (later, we will 
also rename the voters so that they are the same as the candidates). If ||y|| < ||C||, we want 
to add a collection of new dummy voters V such that \\V\\ + \\V'\\ = \\C\\ and such that 
adding V to an election does not change the relative Copeland^ scores of the candidates. 
This can be accomplished by letting half of the voters in V' vote C (recall Convention A) 
and half of the voters in V vote C . Of course, this can only be done if \\V'\\ is even. 

So, we will do the following. If ||y|| < ||C||, we add a collection of new voters V such 
that ||y'|| = ||C|| - \\V\\ if ||C|| - ||y|| is even, and ||y'|| = ||C|| - ||F|| + 1 if ||C|| - \\V\\ 
is odd. If ||y|| > ||C||, we let V = 0. Half of the voters in V vote C and half of 
the voters in V' vote C . In addition, we introduce a set A of new candidates such that 
lldl + 11^11 = 11^11 + Il^'ll + IIM^II- Note that this is always possible, since ||T^|| + ||^'|| > ||C||. 
We extend the votes of the voters (in V, V' , and W) to C U ^ by taking their preference 
order on C and following this by the candidates in A in some fixed, arbitrary order. Note 
that this will have the effect that candidates in A will never be winners. 

Let W CW, A' CA, E = {C, V U W), E' = {C U A', l^ U y' U W). It is easy to see 
that the following hold (recall that V is not empty). 

1. For ah d G A', score^,((i) < P'|| - 1. 

2. For all c ^ C, scove\;,{c) = score^(c) + ||^'||. 

3. For all c,c' € C,c y^ c', score^(c) — scove\;{c') = score]^,(c) — score^,(c'). 

4. p is a unique Copeland winner of E if and only if p is a unique Copeland winner of 
E'. 

We are now ready to define the reduction. Name the voters such that names(yul^') ^ C 
and names(y UV'UW) = CuA. Then map {C, V, W,p, k) to (C, A, ^ U V , W,p, \\A\\,k). 
We claim that p can be made a unique Copeland winner of (C, V) by adding at most k 
voters from W if and only if p can be made a unique OriginalLlull winner of (C, V U V) by 
adding (an unlimited number of) candidates from A and at most k voters from W. 

First suppose that W' is a subcollection of W of size at most k such that p is the 
unique Copeland^ winner of (C, V U W). Let A' C A he the set of candidates such that 
C U A' = names(y U y' U W'). By item |4] above, p is the unique Copeland winner of 
{CLlA',VLlV'UW'), and thus p is the unique OriginalLluh winner oi {CLIA',VLIV'LI W) . 

For the converse, suppose that there exist A' (^ A and W C W such that ||Vl^'|| < k, 
and p is the unique OriginalLlull winner of (C U A', 1/ U y U W). Then p is the unique 
Copeland^ winner of {CUA', VUV'uW), and, by itemdj p is the unique Copeland^ winner 

of (C,yuT^')• 
Thus our reduction is correct and, since it can be computed in polynomial time, the 

proof is complete. D 

OriginalLlull is neutral (permuting the names of the candidates does not affect the 
outcome of an election) but not anonymous (renaming the voters can change the outcome 
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of an election). By sneakily building the preference orders of the voters into the names of 
the candidates, we can make the system anonymous as well as neutral (at the price of losing 
naturalness). 

Theorem 3.9. There exists a neutral and anonymous election system. £ such that E is 
vulnerable to both constructive AC control and constructive AV control but is resistant to 
constructive AC+AV control. 

Proof. We first describe 8. On input (C, V)^ an election, if there exists a set / C N^ and 
bijections c from / to C and v from ItoV such that for all i £ I, c{i) = (i, >j) where >j is 
a preference order on / (i.e., we interpret candidate names as pairs consisting of a positive 
integer and a preference order on /) and voter v{i) corresponds to candidate c{i) in the 
sense that for all j, k £ I, j >i k if and only if c(j) > c{k) in voter w(z)'s preference order, 
then the winners are exactly the Copeland winners. Otherwise, there are no winners. 

Note that £ is neutral and anonymous and basically the same as OriginalLlull. The 
same argument as used for OriginalLlull in the proof of Theorem 13. 81 shows that £ is vulner- 
able to constructive AC and AV control and susceptible to AC+AV control. To show that 
constructive £^-AC+AV control is NP-hard, we adapt the reduction from from construc- 
tive Copeland -AV control to constructive OriginalLlull- AC+AV control from the proof of 
Theorem 13. 8[ Let C be a set of candidates, V and W be two disjoint collections of voters 
with preference lists over C, p £ C the preferred candidate, and k £ N. Without loss of 
generality, we assume that V is not empty. Let V' and A be as in the proof of Theorem 
Recall that |jyuy|| > ||C|| and ||yuyuW^|| = ||CUyl||. From the proof of Theorem 
we have the following. 

Claim 3.10. Let W CW, A' CA, E= (C, V U W), E' = {C U A', VUV'uW). p is a 
unique Copeland winner of E if and only if p is a unique Copeland winner of E' . 

We are now ready to define the reduction. We will first rename the candidates. Note 
that renaming candidates does not change the outcome of a Copeland election. Number 
the candidates in C L) A from 1 to ||C U A|| such that the candidates in C are numbered 
from 1 to ||C||. Number the voters inVUV'UW from 1 to \\V UV U W\\ (= \\C U ^||) 
such that the voters in ||y U y'|| are numbered from 1 to ||T^ U y'||. Now rename candidate 
i to Ci = (i, >i) where >j is the preference order on {!,..., ||C|| + ||^||} such that for all 
j, k £ {1, . . . , ||C|| + ll^ll}, j >i k if and only if j > A; in voter i. Rename all candidates 
occurring in C, A, V, V, and W in this way. We claim that p can be made a unique 
Copeland winner of (C, V) by adding at most k voters from W if and only if p can be 
made a unique £ winner of (C, V U V) by adding candidates from A and at most k voters 
from W. 

First suppose that W' is a subcollection of W of size at most k such that p is the 
unique Copeland winner of {C,V U W'). Let A' <^ A he the set of candidates such that 
CU A' = {ci I voter i is in F U y' U W'}. By Claim [3TT0l p is the unique Copeland winner 
of (C UA',VUV'LI W), and thus p is the unique £ winner of (C UA',VUV'U W). 

For the converse, suppose that there exist A' C A and W C W such that \\W'\\ < k, 
and p is the unique £ winner of (C U A', V UV U W). Then p is the unique Copeland^ 
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winner oi {C U A' ,V U V' U W), and by Claim [STTOl p is the unique Copeland winner of 

{c,vuw'). 

Thus our reduction is correct and, since it can be computed in polynomial time, the 
proof is complete. D 

4 Control in Maximin 

In this section we initiate the study of control in the maximin election system. Maximin 
is loosely related to Copeland" voting in the sense that both are defined in terms of the 
pairwise head-to-head contests. In addition, the unweighted coalitional manipulation prob- 
lem for maximin and Copeland"^ (a 7^ 0.5) exhibits the same unusual behavior: It is in 
P for one manipulator and NP-complete for two or more manipulators |XCPR09llFHS08l 
IFHSlOj . Thus one might wonder whether both systems will be similar with regard to their 
resistances to control. In fact, there are very interesting differences. 

It is easy to see that maximin is susceptible to all basic types of constructive and destruc- 
tive control. And so, by Theorem 13.31 to show vulnerability to constructive (destructive) 
C control it suffices to give a polynomial-time algorithm that decides the constructive (de- 
structive) £-C problem, and to show resistance to constructive (destructive) C control it 
suffices to show that the constructive (destructive) £-C problem is NP-hard. 

4.1 Candidate Control in Maximin 

Let us now focus on candidate control in maximin, that is, on AC, ACu, and DC control 
types, both in the constructive and in the destructive setting. As is the case for Copeland", 
< a < 1, maximin is resistant to control by adding candidates. 

Theorem 4.1. Maximin is resistant to constructive AC control. 

Proof. We give a reduction from X3C. Let {B,S), where B = {bi,... ,63^} is a set of 
3A; elements and S = {Si, . . . , Sn} is a set of 3-subsets of B, be our input X3C instance. 
We form an election E = {C U A, V), where C = B U {p}, A = {oi, . . . , a„}, and V = 
(vi, . . . ,V2n+2)- (Candidates in A are the spoiler candidates, which the attacker has the 
ability to add to election {C,V).) 

Voters in V have the following preferences. For each Si G S, voter Vi reports preference 
list p > B — Si > ai > Si > A — {aj} and voter Vn+i reports preference list A — {oj} > a^ > 
Si > B — Si > p. Voter f 2n+i reports p > A > B and voter f 2n+2 reports B > p > A. 

We claim that there is a set A' <^ A such that ||A'|| < k and p is a unique winner of 
(C U A', V) if and only if {B,S) is a "yes" -instance of X3C. 

To show the claim, let E' = (C, V). For each pair of distinct elements bi,bj £ B, we have 
that NE'{bi,bj) = n + 1, N^'ip^bi) = n + 1, and N^'ipi^p) = n + 1. That is, all candidates in 
E' tie. Now consider some set A" C A, \\A"\\ < k, and an election E" = {CuA", V). Values 
of Ne" and N^' are the same for each pair of candidates in {p} UB. For each pair of distinct 
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elements Oj, Oj G A" , we have Ne»{p-, ai) = n + 2, NE"{ai,p) = n, and NE"{ai, aj) = n + 1. 
For each bi £ B and each a^ € A" we have that 

. . ( n libi £ Sj, 

and, of course, NE"{aj, hi) = 2n + 2 — NE"{bi, aj). Thus, by definition of maximin, we have 
the following scores in E": (a) score£'//(p) = n + 1, (b) for each aj € A", scoTeE"iaj) = n, 
and (c) for each hi £ B, 

score^.(6.) = I " iH3a, £ A")[b, £ S,], 

I n + 1 otherwise. 

A" corresponds to a family S" of 3-sets from S such that for each j, 1 < j < n, S" 
contains set Sj if and only if A" contains aj. Since ||^"|| < /c, it is easy to see that p is a 
unique winner of E" if and only if S" is an exact cover of i?. D 

Copeland", < a < 1, is resistant to constructive AC control, but for a £ {0, 1}, 
Copeland" is vulnerable to constructive control by adding an unlimited number of candi- 
dates. It turns out that so is maximin. However, interestingly, in contrast to Copeland, 
maximin is also vulnerable to DC control, and in fact even to ACu+DC control. Intuitively, 
in constructive ACu+DC control we should add as many candidates as possible (because 
adding a candidate generally decreases other candidates' scores, making our preferred candi- 
date's way to victory easier) and then delete those candidates who stand in our candidate's 
way (i.e., those whose existence blocks the preferred candidate's score from increasing). 
Studying constructive ACu+DC control for maximin jointly leads to a compact, coherent 
algorithm. If we were to consider both control types separately, we would have to give two 
fairly similar algorithms while obtaining a weaker result. 

Theorem 4.2. Maximin is vulnerable to constructive AC^+DC control. 

Proof. We give a polynomial-time algorithm for constructive maximin-ACu+DC control. 
The input contains an election E = (C,V), a set of spoiler candidates A, a preferred 
candidate p £ C, and a nonnegative integer /cdc- Voters in V have preference lists over the 
candidates in C U A. We ask whether there exist sets A' Q A and C Q C such that (a) 
IIC^'ll < ^DC and (b) p is a unique winner of election ((C — C") U A' , V). If A;dc > He'll — 1) 
we accept immediately because we can delete all candidates but p. Otherwise, we use the 
following algorithm. 

Preparation. We rename the candidates in C and A so that C = {p, ci, . . . ,Cm} and A = 
{cm+i, ..., Cm+ni'}- Let E' = (C U A, V) and let P = {Ne'{p, q) | q G C U A}. That 
is, P contains all the values that candidate p may obtain as scores upon deleting some 
candidates from E' . For each k £ P, let Q{k) = {ci \ Ci £ CuA — {p}ANei{p, q) < k}. 
Intuitively, Q{k) is the set of candidates in E' that prevent p from having at least k 
points. 
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Main loop. For each k (z P, our algorithm tests whether by deleting at most fcoc candi- 
dates from C and any number of candidates from A it is possible to ensure that p 
obtains exactly k points and becomes a unique winner of E'. Let us fix some value 
k & P. We build a set D of candidates to delete. Initially, we set D = Q{k). It is 
easy to see that deleting candidates in Q{k) is a necessary and sufficient condition for 
p to have score k. However, deleting candidates in Q{k) is not necessarily sufficient 
to ensure that p is a unique winner because candidates with scores greater or equal 
to k may exist. We execute the following loop (which we will call the fixing loop): 

1. Set E" = {{CVJA)-D,V). 

2. Pick a candidate d € {CVJ A) — D such that score^;// (d) > k (break from the loop 
if no such candidate exists) . 

3. Add d to D and jump back to Step [TJ 

We accept if C fl I? < /cdc and we proceed to the next value of k otherwiseO If none 
of the values k ^ P leads to acceptance then we reject. 

Let us now briefly explain why the above algorithm is correct. It is easy to see that in 
maximin adding some candidate c to an election does not increase other candidates' scores, 
and deleting some candidate d from an election does not decrease other candidates' scores. 
Thus, if after deleting candidates in Q{k) there still are candidates other than p with k 
points or more, the only way to ensure p's victory — without explicitly trying to increase 
p's score — is by deleting those candidates. Also, clearly, the only way to ensure that p has 
exactly k points is by deleting candidates Q{k). 

Note that during the execution of the fixing loop, the score of p might increase to some 
value k' > k. If that happens, it means that it is impossible to ensure p's victory while 
keeping his or her score equal to k. However, we do not need to change k to k' in that 
iteration of the main loop as we will consider k' in a different iteration. D 

Maximin is also vulnerable to destructive AC+DC control. The proof relies on the 
fact that (a) if there is a way to prevent a despised candidate from winning a maximin 
election via adding some spoiler candidates then there is a way to do so by adding at most 
2 candidates, (b) adding a candidate cannot increase the score of any candidate other than 
the added one, and (c) deleting a candidate cannot decrease the score of any candidate 
other than the deleted one. In essence, the algorithm performs a brute-force search for 
the candidates to add and then uses the constructive maximin-DC control algorithm from 
Theorem 1121 

Theorem 4.3. Maximin is vulnerable to destructive AC+DC control. 



^If we accept, D implicitly describes the control action that ensures p's victory: We should delete from 
C the candidates in C n D and add from A the candidates in ^4 — _D. 
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Proof. We will first give an algorithm for destructive maximin-AC and then argue how 
it can be combined with the algorithm from Theorem 14.21 to solve destructive maximin- 
AC+DC in polynomial time. 

Let us first focus on the destructive AC problem. Our input is an election E = 
{C,V), where C = {d,ci, . . . ,Cm} and V = {vi, . . . ,Vn), a spoiler candidate set A = 
{cm+i, ■ ■ ■ ,Cm'}, and a nonnegative integer A:ac- The voters have preference orders over 
C U A. The goal is to ensure that d is not a unique winner of E via adding at most k\(j 
candidates from A. 

Let us assume that there exists a set A' <^ A such that d is not a unique winner of 
election E' = (CD A', V). Since d is not a unique winner of E', there exists some candidate 
c' & C U A' such that score£;'(c') > scoreE'id). Also, by definition of maximin, there is 
some candidate d' £ C U A' such that score£;'(d) = NE'{d, d'). As a consequence, d is not a 
unique winner of election E" = (CU {c', d'}, V). The reason is that scoiceE"id) = scoreE'id) 
(because both E' and E" contain d') and score£;/'(c') > score£;'(c') (because adding the 
remaining A' — {c', d'} candidates to E" does not increase c"s score). Thus, to test whether 
it is possible to ensure that d is not a unique winner of E, it suffices to test whether there 
is a set A" C A such that \\A"\\ < min(2, /cac) and d is not a unique winner of (C U A" , V). 
Clearly, this test can be carried out in polynomial time. 

Let us now consider the AC+DC case. The input and the goal are the same as before, 
except that now we are also given a nonnegative integer /cdc and we are allowed to delete 
up to /cdc candidates. We now describe our algorithm. For each set {c',d'} of up to 2 
candidates, {c',d'} C (C U A) — {d} we execute the following steps. 

1. We check if ||yl n {c', d'}\\ < /cac (and we proceed to the next {c', d'} if this is not the 
case). 

2. We compute a set Z? C C — {d,c',d'}, \\D\\ < /jdCi that maximizes score£;'(c'), where 
E' = {iCU{c',d'})-D,V). 

3. If d is not a unique winner of E' = ((C U {c' , d'}) — D, V), we accept. 

We reject if we do not accept for any {c', d'} C (C U A) — {d}. 

The intended role of d' is to lower the score of d and keep it at a fixed level, while, of 
course, the intended role of d is to defeat d. By reasoning analogous to that for the AC 
case, we can see that there is no need to add more than two candidates. Thus, given {c', d'}, 
it remains to compute the appropriate set D. In essence, we can do so in the same manner 
as in the constructive AC+DC case. 

Let k be some positive integer. We set D{k) = {ci £ C — {c', d' , d} \ Ne{c' ■, Ci) < k} and 
we pick D = D{i), where i is as large as possible (but no larger than \\V\\) and \\D\\ < /cdc- 
Deleting candidates in D maximizes the score of c', given that we cannot delete d and d' . 
It is easy to see that this D can be computed in polynomial time. D 
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4.2 Control by Adding and Deleting Voters in Maximin 

In this section we consider the complexity of constructive and destructive AV and DV con- 
trol types. (We will consider bribery, BV, in the next section; recall that in this paper, 
bribery is a basic control type, though it is usually treated separately in the literature.) In 
the previous section we have seen that maximin is vulnerable to all basic types of construc- 
tive and destructive candidate control except for constructive control by adding candidates 
(constructive AC control). The situation regarding voter control is quite different: As 
shown in the next three theorems, maximin is resistant to all basic types of constructive 
and destructive voter control. 

Theorem 4.4. Maximin is resistant to constructive and destructive AV control. 

Proof. We will first give an NP-hardness proof for the constructive case and then we will 
describe how to modify it for the destructive case. 

We now give a reduction of the X3C problem to the constructive maximin- AV problem. 
Our input X3C instance is {B,S), where B = {bi, . . . ,63^} is a set of 3k distinct elements 
and S = {Si, . . . , Sn} is a family of n 3-element subsets of B. Without loss of generality, 
we assume k > 1. Our reduction outputs the following instance. We have an election 
E = {C,V), where C = B U {p,d} and V = {vi, . . . ,V4k)- There are 2k voters with 
preference order d > B > p, k voters with preference order p > B > d, and k voters 
with preference order p > d > B. In addition, we have a collection W = {wi, . . . ,Wn) of 
unregistered voters, where the i'th voter, 1 < i < n, has preference order 

B - Si > p > Si > d. 

We claim that there is a subcollection W' C W such that ||H^'|| < k and p is a unique 
winner of election (C, V U W) if and only if {B, S) is a "yes" -instance of X3C. 

It is easy to verify that for each 6j € i? it holds that Ne{p, bi) = 2k, and that Ne{p, d) = 
2k. Thus, scores; (p) = 2k. Similarly, it is easy to verify that scores; (d) = 2k, and that for 
each bi G B, score£;(6j) < k. Let W" be a subcollection of W such that |jl^"|j < k and let 
E" = {C,V U W"). For each bi £ B it holds that scoreE" (bi) < 2k. Since each voter in W 
ranks d as the least desirable candidate, scoTeE"id) = 2k. What is p's score in election E"? 
If there exists a candidate bi € B such that there is no voter Wj in W" that prefers p to bi, 
then scoiceE"{p) = 2k (because NE"{p,bi) = 2k). Otherwise, scoveE"{v) >2k + l. Thus, p 
is a unique winner of E" if and only if W" corresponds to an exact cover of B. This proves 
our claim and, as the reduction is clearly computable in polynomial time, concludes the 
proof for the constructive maximin- AC case. 

To show that destructive maximin-AC is NP-hard, we use the same reduction, except 
that we remove from V a single voter with preference list p > B > d, and we set the task 
to preventing d from being a unique winner. Removing a, p > B > d voter from V ensures 
that before we start adding candidates, d has score 2k (and this score cannot be changed), 
p has score 2k — 1 (and p needs to get one point extra over each other candidate to increase 
his or her score and prevent d from being a unique winner), and each bi £ B has score 
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k — 1 (thus, no candidate in B can obtain score higher than 2k — 1 via adding no more 
than k candidates from W). The same reasoning as for the constructive case proves that 
the reduction correctly reduces X3C to destructive maximin-AV. D 

Theorem 4.5. Maximin is resistant to constructive and destructive DV control. 

Proof. We will first show NP-hardness for constructive maximin-DV control and then we 
will argue how to modify the construction to obtain the result for the destructive case. 

Our reduction is from X3C. Let {B,S) be our input X3C instance, where B = 
{6i, . . . , 63^}, S = {Si, . . . , Sn}, and for each i, I < i < n, \\Si\\ = 3. Without loss of 
generality, we assume that n>A;>3(ifn<fc then S does not contain a cover of B, and 
if /c < 2 we can solve the problem by brute force). We form an election E = (C, V), where 
C = BU{p,d} and where V = V U V", V = [v[, . . . , t;^„), V" = {v'(, ..., v'^^^_^^^). For 
each i, 1 < i < n, voter v^ has preference order 

d>B-Si>p>Si 

and voter u ^_,_^ has preference order 

d>Si>p> B - Si. 

Among the voters in V" we have: 2 voters with preference order p>d>B,n — k voters 
with preference order p > B > d, and n voters with preference order B > p > d. We claim 
that it is possible to ensure that p is a unique winner of election E via deleting at most k 
voters if and only if {B,S) is a "yes" -instance of X3C. 

Via routine calculation we see that candidates in election E have the following scores: 

1. scoreEid) = 2n (because NE{d,p) = 2n and for each bi G B, NEid, hi) = 2n + 2), 

2. scores; (p) = 2n — k + 2 (because NE{p,d) = 2n — k + 2 and for each bi G B, NE{p,bi) = 
2n- k + 2), and 

3. for each hi G B, score£;(6j) <2n — k (because NE{bi, d) = 2n — k). 

Before any voters are deleted, d is the unique winner with k — 2 more points than p. Via 
deleting at most k voters it is possible to decrease d's score at most by k points. Let W be 
a collection of voters such that p is the unique winner of E' = {C, V — W). We partition 
W into W U W", where W contains those members of W that belong to V and W" 
contains those members of W that belong to V" . We claim that W" is empty. For the 
sake of contradiction let us assume that W" ^ 0. Let E" = {C,V — W"). Since every 
voter in V" prefers p to d, we have that NE"{p,d) = NE{p,d) — \\W"\\ and, as a result, 
score^//(p) < scores; (p) — ||H^"||. In addition, assuming W" is not empty, it is easy to 
observe that scoiceE"{d) > scores (d) — |1H^"|| + 1 (the reason for this is that deleting any 
single member of V" does not decrease d's score). That is, we have that: 

scoTeE"{p) < 2n-k + 2-\\W"\\, 
score E"{d) > 2n + l-||W'||. 
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So in E'\ d has at least k — 1 more points than p. Since ||H^"|| > 1, we can delete at most 
k — 1 voters W from election E" . But then p will not be a unique winner of £", which is a 
contradiction. 

Thus, W contains members of V only. Since d is ranked first in every vote in V\ 
deleting voters from W decreases d's score by exactly \\W\\. Further, deleting voters W 
certainly decreases p's score by at least one point. Thus, after deleting voters W we have: 

1. score£;'((i) = 2n — \\W\\, 

2. scoidE'ip) <2n-k + 2-l = 2n-k + l. 

In consequence, the only possibility that p is a unique winner after deleting voters W is that 
\\W\\ = k and we have equality in item [2] above. It is easy to verify that this equality holds 
if and only if W contains k voters among v[, . . . ,v'^ that correspond to an exact cover of B 
via sets from S (recall that k >3). This proves that our reduction is correct, and since the 
reduction is clearly computable in polynomial time, completes the proof of NP-hardness of 
constructive maximin-DV control. 

Let us now consider the destructive case. Let {B,S) be our input X3C instance (with B 
and S as in the constructive case). We form election E = (C, V) which is identical to the one 
created in the constructive case, except that V" = {v'{, . . . ,f^2n-A:) ^^"^ ^^ ^^^ these voters' 
preference orders as follows: There is one voter with preference order p>d>B,n — k 
voters with preference order p > B > d, and n — 1 voters with preference order B > p > d. 
(That is, compared to the constructive case, we remove one voter with preference order 
p > d > B and one with preference order B > p > d.) It is easy to see that d is the unique 
winner of election E and we claim that he or she can be prevented from being a unique 
winner via deleting at most k voters if and only if there is an exact cover of i? by A; sets 
from S. 

Via routine calculation, it is easy to verify that scores; (d) = 2n, and that scores; (p) = 
2n — k. The former holds because NE{d,p) = 2n and NE{d, bi) = 2n + l and the latter holds 
because Ne{p, d) = 2n — k and for each candidate bi (^ B we have Ne{p, h) = 2n — k + l. In 
addition, each candidate bi ^ B has score at most 2n — k — 1. Thus, it is possible to ensure 
that d is not a unique winner via deleting at most k voters if and only if there are exactly k 
voters deleting whom would decrease the score of d by A; points and would not decrease p's 
score. Let us assume that such a collection of voters exists and let W be such a collection. 
Since every voter in V" prefers p to d, clearly W does not contain any voter in V". Thus, 
W contains exactly k voters from V. Since for each bi £ B we have Ne{p, hi) = 2n — k + 1, 
for each bi & B W contains at most one voter who prefers p to bi. Since ||-B|| = 3k and 
A; > 3, this implies that W contains exactly a collection of voters corresponding to some 
exact cover of B by sets in S. This completes the proof for the destructive case. D 

4.3 Bribery in Maximin 

We now move on to bribery in maximin. Given the previous results, it is not surprising that 
maximin is resistant both to constructive bribery and to destructive bribery. Our proof is 
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an application of the "UV technique" of Fahszewski et al. [FHHROQa] . Very informally, the 
idea is to build an election in a way that ensures that the briber is limited to bribing only 
those voters who rank two special candidates ahead of the preferred one. 

Theorem 4.6. Maximin is resistant to constructive and destructive BV control. 



Proof. Our proofs follow via reductions from X3C. The reduction for the constructive case 
is almost identical the one for the constructive case and thus we will consider both cases in 
parallel. 

Our reductions work as follows. Let {B,S) be an instance of X3C, where B = 
{61, . . . , 63^} is a set of 2>k distinct elements, and S = {5i, . . . , 5„} is a family of 3-element 
subsets of B. (Without loss of generality, we assume that n> k > \. If this is not the case, 
it is trivial to verify if {B,S) is a "yes" instance of X3C.) We construct a set of candidates 
C = {p, d, s} U B, where p is our preferred candidate (the goal in the constructive setting is 
to ensure p is a unique winner) and d is our despised candidate (the goal in the destructive 
setting is to prevent d from being a unique winner). We construct six collections of voters, 
V^,V^, V^, V^, y^ V^, as follows: 



1. V^ contains 2n voters, v\, . . . , v\j^. 
following preference orders: 



For each i, 1 <i <n, voters v} and fj^^„ have the 



)] : d > s > Si > p > B - Si 
^ I j : i3 — Si > p > Si > d > s. 



^n+i 



2. V"^ contains 2k voters, v\,. . . ,f|^. For each i, 1 <i <k, voters vf and vfj^^. have the 
following preference orders: 



vf : s > d> p> B 



''^k+i 



: B > d> p> s. 



3. y^ contains 2k voters, vf, . . . ,f|^. For each i, 1 < i < k, voters vf and vf_^i^ have the 
following preference orders: 



'^k+i 



d> s > p> B 
B > s > p> d. 



4. V^ contains 4k voters, vf, . . . , vfj^. For each i, I < i < 2k, voters vf and vf^2k have 
the following preference orders: 



■"2fc+i 



: d> B > p> s 
: s > p> d>B. 
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(a) Values ofiVE,(-,). 
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(b) Values o: 
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n + 4k 
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n + Qk + l 
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4k + 1 
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n + 2k + l 


n + 4k + l 


n + 4k + l 



Table 1: Values of Ne^{-,-) and Nej^{-,-) for each pair of candidates. Let E be one of 
Ec, Efi. An entry in row c' € {p, d, s} and column c" € {p, d, s}, c' 7^ c", of the appropriate 
table above gives value Ne{c' ,c"). For row B and for column B we adopt the following 
convention. For each c S {p, d, s} and for each bi S B, an entry in row B and column c is 
equal to NE{bi, c). For each c G {p, d, s} and for each hi € B, an entry in row c and column 
B is equal to NE{c,bi). For each two distinct bi,bj E B, the entry in row B and column B 
is the upper bound on NE^bi, bj). (For Ed this entry is, in fact, exact.) 



5. V^ contains 2 voters, wf,!'! with the following preference orders 



v! 



s > B > p> d 
d>B>p>s. 



6. V^ contains a single voter, vf, with preference order p > d > s > B. 

We form two elections, Ec and E^, where Ec = {C,V'^ U ■ ■ ■ U V^) and E^ = (C, V^ U 
• • • U y^); that is, Ec and -E^^ are identical except E^ does not contain the single voter from 
V^. Ec contains 2n + 8A; + 3 voters and E^, contains 2n + 8k + 2 voters. Values of Ne^^ and 
Ne^ for each pair of candidates are given in Table [TJ 

For the constructive case, we claim that it is possible to ensure that p is a unique winner 
of election Ec by bribing at most k voters if and only if {B,S) is a "yes" instance of X3C. 
Let us now prove this claim. By inspecting Table [TJ and recalling that n > k > 1, we see 
that scores^ (p) = n + 3/c + 2, scores^(d) = n + 5/c + 1, scoreE^{s) = 4k + 1, and for each 
bi G B, scoieE^ibi) < n + 2k + 1. That is, prior to any bribing, d is the unique winner and 
p has the second highest score. 

It is easy to see that by bribing t < k voters, the briber can change each candidate's 
score by at most t points. Thus, for the bribery to be successful, the briber has to bribe 
exactly k voters in such a way that d's score decreases to n + 4A; + 1 and p's score increases 
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to n + 4A; + 2. To achieve this, the briber has to find a collection V' of voters such that 
||y|| = k, and 

1. each voter in V' ranks p below both d and s, and 

2. for each 6j € B, there is a voter in V' who ranks p below 6j. 

The only voters that satisfy the first condition are vl, . . . ,vl^,vl, . . . ,vl,vf, . . . ,vl. Further, 
among these voters only vl, . . . ,vl^ rank p below some member of B and, in fact, for each i, 
1 < i < n, vj ranks p below exactly three members of B. Thus, it is easy to see that each 
k voters from vj, . . . , t>^, -y^, . . . , t>^, vf , . . . , f| that satisfy the second condition correspond 
naturally to a cover of B by sets from S. (Note that it suffices that the briber bribes voters 
in V' to rank p first without changing the votes in any other way, and that changing the 
votes in any other way than ranking p first is not necessary.) As a result, if it is possible to 
ensure that p is a winner of Ec by bribing at most k voters then {B,S) is a "yes" instance 
of X3C. For the other direction, it is easy to verify that if {B, S) is a "yes" instance of X3C 
then bribing k voters from f |, . . . , t;^ that correspond to a cover of B to rank p first suffices 
to ensure that p is a unique winner. This completes the proof for the constructive case. 

For the destructive case, we claim that it is possible to ensure that d is not a unique 
winner of Ed if and only if (B, S) is a "yes" instance of X3C. The proof is analogous to the 
constructive case: It suffices to note that p is the only candidate that can possibly tie for 
victory with d. The rest of the proof proceeds as for the constructive case. D 

4.4 Connection to Dodgson Voting 

We conclude our discussion of (control in) maximin voting with a small detour, showing a 
connection between maximin and the famous voting rule (i.e., election system) of Dodgson. 

Dodgson voting, proposed in the 19th century by Charles Lutwidge Dodgson|^ works 
as follows [Dod76] . Let E = {C,V) be an election, where C = {ci, . . . ,Cm} and V = 
{vi, . . . ,Vn)- For a candidate Cj G C, the Dodgson score of Cj, denoted score^(ci), is the 
smallest number of sequential swaps of adjacent candidates on the preference lists of voters 
in V needed to make Cj become the Condorcet winner. The candidates with the lowest 
score are the Dodgson election's winners. That is, Dodgson defined his system to elect 
those candidates that are closest to being Condorcet winners in the sense of adjacent-swaps 
distance. Although Dodgson's eighteenth-century election system was directly defined in 
terms of distance, there remains ongoing interest in understanding the classes of voting 
rules that can be captured in various distance-based frameworks (see, e.g., |MN08UEFS09| ). 

Unfortunately, it is known that deciding whether a given candidate is a winner 
according to Dodgson's rule is quite complex. In fact, Hemaspaandra, Hemaspaan- 
dra, and Rothe [HHR97J . strengthening an NP-hardness result of Bartholdi, Tovey, and 
Trick |BTT89b] . showed that this problem is complete for parallelized access to NP. That 
is, it is complete for the Bg level of the polynomial hierarchy. Nonetheless, many re- 
searchers have sought efficient ways of computing Dodgson winners, for example by using 



^"Dodgson is better known as Lewis Carroll, the renowned author of "Alice's Adventures in Wonderland.' 
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frequently correct heuristics |HH09UMPS08j . fixed-parameter tractability (see [BTT89b"l 
IFHHOQaUBGNlO j and the disc ussion in Footnote 17 of |FHHR09a] ). and approximation 
algorithms for Dodgson scores |CCF"'"09] . 

In addition to its high computational cost in determining winners, Dodgson's rule is 
often criticized for not having basic properties one would expect a good voting rule to have. 
For example, Dodgson's rule is not "weakCondorcet consistent" (equivalently, it does not 
satisfy Fishburn's "strict Condorcet principle") [ BBHHlOj and doesn't satisfy homogeneity 
and monotonicity (see |Bra09j . which surveys a number of defects of Dodgson's rule). We 
provide definitions for the latter two notions, as they will be relevant to this section. 

Homogeneity. We say that a voting rule TZ is homogeneous if for each election E = (C, V), 
where C = {ci, . . . , Cm} and V = (vi, . . . , Vn), it holds that TZ has the same winner 
set on E as on E' = (C, V'), where V' = (fi,fi,f2,t'2) • • • ,Vn,Vn)- 

Monotonicity. We say that a voting rule 7^ is monotone if for each election E = (C, V), 
where C = {ci, . . . , Cm} and V = {vi, . . . , f„), it holds that if some candidate Ci € C 
is a winner of E then Cj is also a winner of an election E' that is identical to E 
except that some voters rank Cj higher (without changing the relative order of all the 
remaining candidates). 

Continuing the Caragiannis et al. JCCF"'"09] line of research on approximately comput- 
ing Dodgson scores, Caragiannis et al. [CKKPIO] devised an approximation algorithm for 
computing Dodgson scores that, given an election E = {C, V), where C = {ci, . . . , Cm} and 
V = (f 1, . . . , Vn) and a candidate q in C, computes in polynomial time a nonnegative inte- 
ger scE{ci) such that score^(ci) < scE{ci) and sce(cj) = 0(m log m) • score^(cj). That is, 
the algorithm given by Caragiannis et al. [CKKPIO] is, in a natural sense, an 0{m\ogm)- 
approximation of the Dodgson scorej^ This algorithm has additional properties: If one 
defines a voting rule to elect those candidates that have lowest scores according to the algo- 
rithm, then that voting rule is Condorcet consistent (i.e., when a Condorcet winner exists, 
he or she is the one and only winner under the voting rule), homogeneous, and monotone. 

The result of Caragiannis et al. [CKKPIO] is very interesting, but unfortunately the 
voting rule defined by their approximation algorithm is somewhat complicated and arguably 
might seem not to be very natural. We now show that the maximin rule — which like the 
Caragiannis et al. rule is Condorcet-consistent, homogeneous, and monotone, but which in 
addition is a long-existing and natural rule — also elects candidates that are, in a certain 
different yet precise sense, "close" to being Dodgson winners. Our proof is inspired by that 
of Caragiannis et al. [CKKPIO] . 



^^Throughout this section, we use the notion "/(m)-approximation of g" in the sense it is typically used 
when dealing with minimization problems. That is, we mean that the approximation outputs a value that 
is at least g and at most /(m) ■ g. We slightly abuse the interaction between this notation and Big-Oh 
notation, in the quite standard and intuitive way. And we assume that the argument domain that g and the 
approximation share is clear from context — in this paper, their arguments are an election E and a candidate 
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Theorem 4.7. Let E = {C,V) he an election and let W (^ C be a set of candidates that 
win in E according to the niaxiniin rule. Let m = \\C\\ and let s = niinc-gc'score^(ci). For 
each Ci € W it holds that s < score^(cj) < m'^s. 

Proof. Let us fix an election E = (C, V) with C = {ci, . . . Cm} and V = (vi, . . . , Vn)- For 
each two candidates Cj, Cj G C we define df_B(ci, Cj) to be the smallest number k such that 
if k voters in V changed their preference order to rank Cj ahead of Cj, then Cj would be 
preferred to Cj by more than half of the voters. Note that if for some Ci,Cj G C we have 
df£;(cj, Cj) > then 

NE{ci,Cj) +diE{ci,Cj) = 



+ 1. 



For each candidate q G C we define sc^(ci) to be 

sc'^ici) = m^ max{df £;(cj,Cj) | c -,• € C - {c,;}}. 

We now prove that sc' is an rn-^-approximation of the Dodgson score. 

Lemma 4.8. For each Ci G C it holds that score^(cj) < sc^(ci) < ?7i^score^(cj). 

Proof. Let us fix some Ci £ C. To see that the second inequality in the lemma statement 
holds, note that maxjdf^; (ci,Cj) | Cj € C — {q}} < Ylc-^c-fcA'^^EiciTCj) < score^(cj) 
because for each candidate c^ we, at least, have to perform df£;(cj, c^) swaps to ensure that 
Cj defeats Ck in their majority head-to-head contest. Thus, after multiplying by m^, we have 

m max{df£;(cj,Cj) \ Cj £ C — {cj}} < m scoreg(cj). 

Let us now consider the first inequality. Let c^ be some candidate in C — {q}. To make 
sure that Cj is ranked higher than Ck by more than half of the voters, we can shift Cj to 
the first position in the preference lists of max{df ^ (cj , Cj ) | Cj G C — {cj}} > dfE(ci,Cfc) 
voters (or, all the remaining voters if less than max{df£'(cj, Cj) | Cj € C — {cj}} voters do 
not rank ct as their top choice). This requires at most m adjacent swaps per voter. Since 
there are m — 1 candidates in C — {cj}, rn,^ max{df£;(cj, Cj) \ Cj £ C — {cj}} adjacent swaps 
are certainly sufficient to make Cj a Condor cet winner. (Lemma 14. 8p D 

It remains to show that if some candidate q is a maximin winner in E then sc^(cj) is 
minimal. Fortunately, this is easy to see. If some candidate Cj is a Condorcet winner of 
E then he or she is the unique maximin winner and he or she is the unique candidate Cj 
with sc^(cj) = 0. Let us assume that there is no Condorcet winner of E. Let us fix some 
candidate Ci £ C and let Ck & C — {cj} be a candidate such that sc^(cj) = 7Ti^df£;(cj,Cfe). 
That is, dfE(cj,Cfc) = max{df£;(ci,Cj) \ Cj G C — {cj}} and df£;(cj,Cfe) > 0. Due to this last 
fact and our choice of c^, we have df^(cj, c^) = [^J -|- 1 — NE{ci,Ck) and so 



Tl 

NE{ci,Ck)= - +l-diE{ci,Ck) = min iV£;(ci, Cj) = scores; (q), 

Cj&C-{ci} 
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where score£;(ci) is the maximin score of Cj in E. Thus each candidate Ci with the lowest 
value sc^(ci) also has the highest maximin score. D 
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Theorem l4.7l savs that every maximin winner's Dodgson score is no less than the Dodgson 
score of the Dodgson winner (s) (that fact of course holds trivially), and is no more than 
m^ times the Dodgson score of the Dodgson winner (s). That is, we have proven that no 
candidate whose Dodgson score is more than rv? times that of the Dodgson winner(s) can 
be a maximin winner. 

Since maximin is Condorcet consistent, homogeneous, and monotone, our result inter- 
estingly relates to the approximation of Caragiannis et al. [CKKPIO] . who achieved an 
0(?7ilog?TT.)-approximation of Dodgson score while maintaining Condorcet consistency, ho- 
mogeneity and monotonicity (recall the discussion before Theorem I4.7P . Admittedly, our 
"closeness" factor is ni^, which is worse than achieving 0{mlogm). And our closeness is 
in a different sense, since our theorem is applying its bound just between Dodgson scores, 
and just on the winner set. In contrast, Caragiannis et al. [CKKPIO] and even our own 
Lemma 14.81 relate the Dodgson score to the Caragiannis et al. score and the sc' score, and 
those approximations hold for all candidates. However, we achieve our m^ closeness factor 
for a voting rule, maximin, that is well known and natural. 

5 Fixed-Parameter Tractability 

In this section we consider the parameterized complexity of multipronged control, in par- 
ticular, the case where we can assume that the number of candidates is a small constant. 
Elections with few candidates are very natural: For example, in many countries presidential 
elections involve only a handful of candidates. The reader can easily imagine many other 
examples. 

The main result of this section is that for many natural election systems £ (formally, 
for all election systems whose winner determination problem can be expressed via an inte- 
ger linear program of a certain form), it holds that the £'-AC-|-DC-|-AV+BV+BV control 
problem is fixed-parameter tractable (is in the complexity class FPT) for the parameter 
"number of candidates," both in the constructive setting and in the destructive setting. 
This result combines and significantly enhances FPT results from the literature, in par- 
ticular, from the papers [FHH09allFHHR09aj . which are the model for and inspiration of 
this section. We also make explicit an "automatic" path to such results that is implicit 
in |FHH09allFIIIIR09a) . This path should be helpful in letting many future analyses be 
done as tool-application exercises, rather than being case-by-case challenges. 

In this section we focus exclusively on the number of candidates as our parameter. That 
is, our parameter is the number of candidates initially in the election plus the number of 
candidates (if any) in the set of potential additional candidates. That is, in terms of the 
variables we have been using to describe multiprong control the parameter is ||C|| -|- \\A\\. 

We mention that researchers sometimes analyze other parameterizations. For example, 
Liu et al. |LFZL09] . Liu and Zhu [LZlOj . and Betzler and Uhlmann |BU09j consider as 
the parameter the amount of change that one is allowed to use (e.g., the number of candi- 
dates one can add), Bartholdi, Tovey, and Trick ^BTT89b] . Betzler and Uhlmann [BU09J . 
and Faliszewski et al. |FHHR09a] study as the parameter the number of voters (and also 
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sometimes the number of candidates). And other parameters are sometimes used when 
considering the so-cahed possible winner problem, see, e.g., |BD091lBHN09| . However, we 
view the parameter "number of candidates" as the most essential and the most natural one. 
We now proceed with our discussion of fixed-parameter tractability, with the number of 
candidates as the parameter. 

Let us consider an election system £ and a set C = {ci, . . . , Cm} of candidates. There are 
exactly ml preference orders over the candidates in C and we will refer to them as oi, . . . , Om\- 
Let us assume that £ is anonymous (i.e., the winners of each £ election do not depend on 
the order of votes or the names of the voters, but only — for each preference order Oj — on 
the number of votes with that preference order). We define predicate win£{cj,ni, . . . ,nm\) 
to be true if and only if Cj is a unique winner of £ elections with C = {ci, . . . , Cm}, where 
for each i, 1 < i < ml, there are exactly n, voters with preference order Oj. For the rest 
of this section, our inequalities always use one of the four operators ">," ">," "<," and 

u^ j)[l2| 

Definition 5.1. We say that an anonymous election system £ is unique-winner (nonunique- 
winner) integer-linear-program implementable if for each set of candidates C = {ci, . . . , Cm} 
and each candidate Cj € C there exists a set S of linear inequalities with variables ni, . . . , Umi 
such that: 

1. If the integer assignment ui = fii, . . ., nm\ = fim^ satisfies S, then each hi belongs to 



2. S can be computed (i.e., obtained) in time polynomial in m\^^ and 

3. for each {hi, . . . , hm\) G N™', we have that (a) holds if and only if (b) holds, where (a) 
and (h) are as follows: 

(a) S is satisfied by the assignment ui = hi, . . ., n^i = n^i. 



^■^We allow both strict and nonstrict inequalities. Since we allow only integer solutions, it is easy to 
simulate strict inequalities with nonstrict ones and to simulate nonstrict inequalities with strict ones, in 
both cases simply by adding a "1" to the appropriate site of the inequality. So we could equally well have 
allowed just strict, or just nonstrict, inequalities. 

^ It is easy to to put m\ inequalities into S enforcing this condition. And this condition will help us make 
the electoral part of our definition meaningful, i.e., it will avoid having problems from the restriction in the 
final part of this definition that lets us avoid discussing negative numbers of voters. 

^*We mention in passing that if the m\ in this part of the definition were changed to any other computable 
function of m, e.g., m"" , we would still obtain FPT results, and still would have them hold even in the 
strengthened version of FPT in which the / of "/(parameter) ■ Inputsize '^■'" is required to be computable. 
However, due to m\ being the number of preference orders over m candidates, having S be obtainable in 
time polynomial in m\ will in practice be a particularly common case. 

We also mention in passing that the FPT-establishing framework in this section and the results it yields, 
similarly to the case in our work mentioned earlier [FHH09allFHHR09a) . not only will apply in the model 
where votes are input as a list of ballots, one per person, but also will hold in the so-called "succinct" model 
(see [FHH09a,FHHR09a ), in which we are given the votes not as individual ballots but as binary numbers 
providing the number of voters having each preference order (or having each occurring preference order). 
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(b) Cj is a unique winner (is a winner) of an 8 election in which for each i, 1 < 
i < m\, there are exactly hi voters with preference order Oj, where Oi is the i'th 
preference order over the set C . 

In a slight abuse of notation, for integer-linear-program implementable election sys- 
tems £ we will simply refer to the set S of linear inequalities from Definition 15.11 as 
wins{cj,ni, . . . ,nm\)- The particular set of candidates will always be clear from context. 
Naturally, it is easy to adapt Definition 15.11 to apply to approval voting, but for the sake of 
brevity we will not do so. 

We are not aware of any natural systems that are integer-linear-program unique-winner 
implementable yet not integer-linear-program nonunique-winner implementable, or vice 
versa. In this paper we focus on the unique winner model so the reader may wonder 
why we defined the nonunique winner variant of integer-linear-program implementability. 
The answer is that, as we will see later in this section, it is a useful notion when dealing 
with destructive control. 

The class of election systems that are integer-linear-program implementable is remark- 
ably broad. For example, it is variously implicit in or a consequence of the results 
of |FHH09a] that plurality, veto, Borda, Dodgson, and each polynomial-time computable 
(in the number of candidates) family of scoring protocols are integer-linear-program imple- 
mentableri For many other election systems (e.g., Kemeny |Kem59pYL78j and Copeland) 
it is not clear whether they are integer-linear-program implementable, but there are similar 
approaches that will be as useful for us. We will return to this issue at the end of this 
section. 

Theorem 5.2. Let £ be an integer-linear-program unique-winner implementable election 
system. For number of candidates as the parameter, constructive £-AC-l-DC-l-AV-hDV-l-BV 
is in FPT. 

Proof. Let (C, A, F, W^p, /caCj ^DC) ^AV; ^DV; ^Bv) be our input instance of the construc- 
tive £'-AC-FDC-FAV+DV-FBV control problem, as described in Definition ETH Let C = 
{p,ci, . . . , Cm'} and A = {oi, . . . , am"}- Our parameter, the total number of candidates, is 
m = m' -\-m" + 1. For each subset K of CVJA we let of^, . . . , ojj]^,,, mean the ||i^||! preference 
orders over K. 

The idea of our algorithm is to perform an exhaustive search through all the subsets of 
candidates K^ K (^CiJA, and for each K check whether (a) it is possible to obtain K from 
C by deleting at most /cdc candidates and adding at most A;ac candidates from A, and (b) 
it is possible to ensure that p is a unique winner of election (i^, V) by deleting at most A;dv 
voters, adding at most A;av voters from W , and bribing at most /cbv voters. Given K, step 



^®Let m be the number of candidates. A scoring protocol is a vector of m nonnegative integers satisfying 
Qfi > a2 > • • • > ctm- Each candidate receives ai points for each vote that ranks him or her in the i'th 
position, and the candidate(s) with most points win. Many election systems can be viewed as families of 
scoring protocols. For example, plurality is defined by scoring protocols of the form (1,0, ...,0), veto is 
defined by scoring protocols of the form (1, . . . , 1, 0), and Borda is defined by scoring protocols of the form 
(m — 1, m — 2, . . . , 0), where m is the number of candidates. 
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(a) can easily be implemented in polynomial time. To implement step (b), we introduce a 
linear integer program P{K), which is satisfiable if and only if step (b) holds. Let us now 
fix i^ C C U ^ and describe the integer linear program P{K). 

We assume that p G -fC as it is not legal to delete p (and it would be pointless, given 
that we want to ensure his or her victory). We interpret preference orders of voters in V 
and W as limited to the candidate set K. We use the following constants in our program. 
For each i, 1 < i < ||-ft^||!, we let n( be the number of voters in V with preference order of^, 
and we let nY be the number of voters in W with preference order of^ . P{K) contains the 
following variables (described together with their intended interpretation): 

Variables av\, . . . , ai)||j^||!. For each i, 1 < i < ||i^||!, we interpret avi as the number of 
voters with preference of that we add from W . 

Variables di>i, . . . , di7||^||!. For each i, 1 < i < ||i^||!, we interpret dvi as the number of 
voters with preference of that we delete from V. 

Variables bvi^i,bvi^2, ••• ,bvi^l\Kil,,bv2,i, ... ,bv\\K\\<,\\K\\i- For each i,j, 1 < i,j < 
||i^||!, we interpret bvij as the number of voters with preference of that, in case 
i 7^ J, we bribe to switch to preference order of , or, in case i = j, we leave unbribed. 

P{K) contains the following constraints. 

1. All the variables have nonnegative values. 

2. For each variable avi, 1 < i < ||i^||!, there are enough voters in W with preference 
order of to be added. That is, for each i, 1 < i < ||-f^||!, we have a constraint 
avi < nY ■ Altogether, we can add at most kp^ voters so we have a constraint 

3. For each variable dwj, 1 < i < ||i^||!, there are enough voters in V with preference 
order of to be deleted. That is, for each i, 1 < i < ||-?^||!, we have a constraint 



dvi < n^. Altogether, we can delete at most /cdv voters so we have a constraint 

For each variable bvi^j, 1 < i,j < ||i^||!, there are enough voters with preference of 
to be bribed. That is, for each i, 1 < i < ||i^||!, we have a constraint X^LJ 6fij = 
nf + avi — dvi (the equality comes from the fact that for each i, 1 < i < \\K\\\, bvi^i 
is the number of voters with preference of that we do not bribe). Altogether, we can 
bribe at most /cbv voters so we also have a constraint 

j|_ft:j|! ||X||! \ ||X||! 

y^ y^ bvij - ^ bvi^i < /cBv- 
=1 i=i / i=i 
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5. Candidate p is the unique winner of the election after we have executed all the adding, 
deleting, and bribing of voters. Using the fact that £ is integer-linear-program unique- 
winner implement able, we can express this as win£(p,ii, . . . ,i\\j^m), where we sub- 
stitute each ij, I < j < \\K\\\, by Yli=i ^Vij (note that, by previous constraints, 
variables describing bribery already take into account adding and deleting voters). 
This is a legal integer-linear-program constraint as win^^pjii, . . . ,i\\K\\\) is simply a 
conjunction of linear inequalities over ii, . . . !-^||x||!- 

The number of variables and the number of inequalities in P{K) are each polynomially 
bounded in m!. Keeping in mind Definitions 13.11 and I5.H it is easy to see that program 
P(K) does exactly what we expect it to. And testing whether P{K) is satisfiable (i.e., has 
an integer solution, as we are in the framework of an integer linear program) is in FPT, 
with respect to the number of candidates being our parametrization, by using Lenstra's 
algorithm |Len83] . Thus our complete FPT algorithm for the £:-AC-FDC+AV-hDV+BV 
problem works as follows. For each subset K of C U ^ that includes p we execute the 
following two steps: 

1. Check whether it is possible to obtain K from C by deleting at most /cdc candidates 
and by adding at most A:ac candidates from A. 

2. Form linear program P{K) and check whether it has any integral solutions using the 
algorithm of Lenstra |Len83j . Accept if so. 

If after trying all sets K we have not accepted, then reject. 

From the previous discussion, this algorithm is correct. Also, since (a) there are exactly 
2™~^ sets K to try, (b) executing the first step above can be done in time polynomial 
in m, and (c) the second step is in FPT (given that m is the parameter), constructive 
£:-AC+DC+AV-hDV+BV is in FPT for parameter m. D 

The above theorem deals with constructive control only. However, using its proof, it is 
easy to prove a destructive variant of the result. We say that an election system is strongly 
voiced [HHR07] if it holds that whenever there is at least one candidate, there is at least 
one winner. 

Corollary 5.3. Let £ he a strongly voiced, integer-linear-program nonunique-winner imple- 
mentahle election system. Destructive £-AC-l-DC-l-AV-hDV+BV is in FPT for the param- 
eter number of candidates. 

To see that the corollary holds, it is enough to note that for strongly voiced election 
systems a candidate can be prevented from being a unique winner if and only if some other 
candidate can be made a (possibly nonunique) winner (see e.g.. Footnote 5 of |HHR07j 
for a relevant discussion) . Thus to prove Corollary 15. 3^ we can simply use an algorithm 
that for each candidate other than the despised one sees whether that candidate can be 
made a (perhaps nonunique) winner, and if any can be made a (perhaps nonunique) win- 
ner, declares destructive control achievable. (And the precise integer linear programming 
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feasibility problem solution given by Lenstra's algorithm will reveal what action achieves 
the control.) This can be done in FPT using the algorithm from the proof of Theorem 
adapted to work for the nonunique-winner problem (this is trivial given that Corollary 
assumes that 8 is integer-linear-program nonunique-winner implementable) . 

Let us now go back to the issue that some election systems may not be integer-linear- 
program implementable. As an example, let us consider maximin. Let E = (C, V) be 
an election, where C = {ci, . . . , Cm} and V = (vi, . . . , u„). As before, by oi, . . . , Om\ we 
mean the m\ possible preference orders over C, and for each i, 1 < z < tti!, by n^ we 
mean the number of voters in V that report preference order Oj. For each q and Cj in C, 
Ci 7^ Cj, we let 0{ci,Cj) be the set of preference orders over C where Cj is preferred to Cj. Let 
k = {ki, . . . , km) be a vector of nonnegative integers such that for each i, 1 < i < m, it holds 
that 1 < ki < m. For such a vector k and a candidate q G C we define M{ci,ki, . . . ,k. 
to be the following set of linear integer inequalities: 



^mj 



1. For each candidate Cj, his or her maximin score is equal to NE{ci,CkJ- That is, for 
each i, j, 1 < i, j < m, i / j, we have constraint J2of,eO(c,,Cf,^) ^k < Y.o^<^o{c,,c,) ^k 

2. Q has the highest maximin score in election E and thus is the unique winner of 
E. That is, for each i, 1 < i < m, i y^ i, we have constraint ^^ g^/ ^ -.nj. > 

T,OkeO{c„Ck,)^k- 

It is easy to see that q is a unique maximin winner of E if and only if there is a vector k = 
(/ci, . . . , km) such that all inequalities of M{c£, ki, . . . , km) are satisfied. It is also clear how 
to modify the above construction to handle the nonunique winner case. Since there are only 
0{in^) vectors k to try and each M(q, fci, . . . , km) contains 0{m?) inequalities, it is easy 
to modify the proof of Theorem 15.21 to work for maximin: Assuming that one is interested 
in ensuring candidate q's victory, one simply has to replace program P{K) in the proof of 
Theorem 15.21 with a family of programs that each include a different M(c£, /ci, . . . , km) for 
testing if q had won. And one would accept if any of these were satisfiable. Thus we have 
the following result. 

Corollary 5.4. Constructive AC+DC+AV+DV+BV control and destructive 
AC+DC+AV+DV+BV control are both in FPT for maximin for the parameter number of 
candidates. 

The above construction for the winner problem in maximin can be viewed as, in effect, 
a disjunction of a set of integer linear programs. Such constructions for the winner problem 
have already been obtained for Kemeny in |FHH09a] and for Copeland in |FHHR09a] . Thus 
we have the following theorem. 

Corollary 5.5. With number of candidates as the parameter, constructive 
AC+DC+AV+DV+BV control and destructive AC+DC+AV+DV+BV control are in 
FPT for Kemeny and, for each each rational a, < a < 1, for Copeland" . 
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We conclude with an important caveat. The FPT algorithms of this section are very 
broad in their coverage, but in practice they would be difficult to use as their running time 
depends on (the fixed-value parameter) m in a very fast-growing way and as Lenstra's algo- 
rithm has a large multiplicative constant in its polynomial running time. Thus the results 
of this section should best be interpreted as indicating that, for multipronged control in our 
setting, it is impossible to prove non-FPT-ness (and so it clearly is impossible to prove fixed- 
parameter hardness in terms of the levels of the so-called "W" hierarchy of fixed-parameter 
complexity, unless that hierarchy collapses to FPT) . If one is interested in truly practically 
implementing a multipronged control attack, one should probably devise a problem-specific 
algorithm rather than using our very generally applicable FPT construction. 

6 Conclusions 

We have shown that combining various types of control into multiprong control attacks is 
a useful technique. It allows us to study more realistic control models, to express control 
vulnerability results and proofs in a compact way, and to obtain vulnerability results that 
are stronger than would be obtained for single prongs alone. 

The main finding of our paper is that, to the extent to which we can draw conclusions 
from the set of election systems that we have studied, vulnerabilities to basic control types 
can often be combined to form a vulnerability to their multipronged control combination. 
(Table [2] summarizes our results regarding the five election systems we have focused on 
in this paper.) However, we have also seen that there exists a natural election system 
that is vulnerable to both constructive AC control and constructive AV control but that is 
resistant to constructive AC-I-AV control. We have also shown that as far as fixed-parameter 
tractability goes, at least with respect to the parameter number of candidates, a very broad 
class of election systems is vulnerable to the full AC-|-DC-|-AV+DV-|-BV control attack. 
And we have taken a small detour and proven that no candidate whose Dodgson score is 
more than ||C|p times the Dodgson winner's score can be a maximin winner. 

This paper studies multipronged control where the prongs may include various standard 
types of control or bribery. However, it is easy to see that our framework can be naturally 
extended to include manipulation. To do so, one would have to allow some of the voters — the 
manipulators — to have blank preference orders and, if such voters were to be included in the 
election, the controlling agent would have to decide on how to fill them in. It is interesting 
that in this model the controlling agent might be able to add manipulative voters (if there 
were manipulators among the voters that can be added) or even choose to delete them 
(it may seem that deleting manipulators is never useful but Zuckerman, Procaccia, and 
Rosenschein |ZPR09) give an example where deleting a manipulator is necessary to make 
one's favorite candidate a winner of a Copeland election). 

We mention as a natural but involved open direction the study of multipronged control 
in the setting where there are multiple controlling agents, each with a diff'erent goal, each 
controlling a different prong. In such a setting, it is interesting to consider game-theoretic 
scenarios as well as situations in which, for example, one of the controlling agents is seeking 
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Table 2: Resistance to basic control types for the five main election systems studied in this 
paper. In the table, I means the system is immune to the given control type, R means 
resistance, and V means vulnerability. As shown in this paper, for each of the five election 
systems, all listed constructive vulnerabilities combine and all listed destructive vulnerabil- 
ities combine. All remaining prongs combine as described by Corollary 13.61 Constructive 
results for AC, ACu, DC, AV, and DV for plurality and Condorcet are due to |BTT92] 
and their corresponding destructive results are due to [HHR07J . All results for AC ,ACu, 
DC, AV, and DV for approval are due to |HHR07j . All results regarding Copeland, are due 
to |FHHR09a] . Constructive bribery results for plurality and approval are due to [FHH09a] . 
and the constructive bribery result for Condorcet is implicit in |FHHR09a] . All the remain- 
ing results (i.e., all results regarding maximin, and destructive bribery results for plurality, 
approval, and Condorcet) are due to this paper. 



an action that will succeed regardless of the action of the other attacker. 
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